Computing residual resource consumption for top-k data reports

ABSTRACT

Methods for providing the capability to resample computer system metrics, while providing improved accuracy over conventional techniques. The system and method conducts monitoring and measuring metrics of system resource consumption of a plurality of entities to generate resource consumption data, generating a report of the resource consumption data for the plurality of entities for each of a plurality of time periods, identifying a number, k, of the plurality of entities as top-k consumers of resources for each of the plurality of time periods, identifying at least one residual entity of the plurality of entities whose resource consumption is not included in the top-k entities based on residual resource consumption data of the entity, and resampling the reports of the resource consumption data corresponding to the top-k entities and to the at least one residual entity to form at least one report covering a time period.

BACKGROUND

The present invention relates to techniques for computing residualresource consumption for top-k data reports, and in particular, relatesto resampling of resource consumption reports so as to include long termresource consumption.

Monitoring systems are important to performance management of computersystems because they may collect a wide range of different types ofmetrics representing the state of the computer system. Typically, suchmonitoring systems keep newer metrics at a high sampling rate, whereasolder metrics are resampled to a lower sampling rate. For standardmetric types, such as quantities and counters, resampling the data isstraight forward. However, to observe computing clusters, other metrictypes, such as the top-k processes consuming a given resource (such asCPU time, memory, etc.) may be preferable.

Top-k metrics report the top-k entities consuming a particular resourceover a given time window (for example, a time window of 10 seconds). Ifsuch reports are to be resampled, multiple reports may be taken togetherto form a new top-k report covering a larger time window (for example,30 seconds). Problems may occur in that the 3 10 second reports may notbe representative for resources consumed over the 30 second window.

Accordingly, a need arises for a technique by which computer systemmetrics may be resampled that provides improved accuracy overconventional techniques.

SUMMARY

Embodiments of the present methods and systems may provide thecapability to resample computer system metrics, while providing improvedaccuracy over conventional techniques. For example, embodiments of thepresent methods and systems may not only collect the top-k entitiesconsuming resources in a given time window, but may also derive for eachentity so called residual resource consumption data. This residualresource consumption data may capture long term resource consumption ofthe entity being monitored. During resampling, this information may betaken into account in order to consider long term resource consumptionthat may be missed during conventional resampling.

For example, in an embodiment, a computer-implemented method formonitoring computer system operation may comprise monitoring andmeasuring metrics of system resource consumption of a plurality ofentities in at least one computer system to generate resourceconsumption data, generating a report of the system resource consumptiondata for the plurality of entities for each of a plurality of timeperiods, identifying a number, k, of the plurality of entities as top-kconsumers of computer system resources for each of the plurality of timeperiods, and identifying at least one residual entity of the pluralityof entities whose resource consumption is not included in the top-kentities based on residual resource consumption data of the entity forthe plurality of time periods.

For example, in an embodiment, the method may further compriseresampling the reports of the system resource consumption datacorresponding to the top-k entities and to the at least one residualentity to form at least one report covering a time period including theplurality of time periods. Identifying at least one residual entity maycomprise determining, for each entity other than the top-k entities,whether the current time period resources used by the entity minus thelast time period resources used by the entity is greater than theresources used by any top-k entity during the time period and if so,adding the identified entity as a residual entity. Identifying at leastone residual entity may comprise determining, for each entity other thanthe top-k entities, whether the resources used by the entity accumulatedover the plurality of time periods is greater than the resources used byany top-k entity during any of the plurality of time periods and if so,adding the identified entity as a residual entity. Identifying at leastone residual entity may comprise determining, for each entity other thanthe top-k entities, whether the resources used by the entity in any ofthe plurality of time periods is greater than the resources used by anytop-k entity during any of the plurality of time periods and if so,adding the identified entity as a residual entity. Residual resourceconsumption data may capture long term resource consumption data of theentity other than the top-k entities. Long term resource consumptiondata may be used during resampling to provide consideration of long termresource consumption not included in resource consumption of the top-kentities. Residual resource consumption data may capture long termresource consumption data of an entity that was included in the top-kentities, but is no longer included in the top-k entities due to theresampling.

For example, in an embodiment, a system for monitoring computer systemoperation may comprise a processor, memory accessible by the processor,and computer program instructions stored in the memory and executable bythe processor to perform monitoring and measuring metrics of systemresource consumption of a plurality of entities in at least one computersystem to generate resource consumption data, generating a report of thesystem resource consumption data for the plurality of entities for eachof a plurality of time periods, identifying a number, k, of theplurality of entities as top-k consumers of computer system resourcesfor each of the plurality of time periods, and identifying at least oneresidual entity of the plurality of entities whose resource consumptionis not included in the top-k entities based on residual resourceconsumption data of the entity for the plurality of time periods. Forexample, in an embodiment, the method may further comprise resamplingthe reports of the system resource consumption data corresponding to thetop-k entities and to the at least one residual entity to form at leastone report covering a time period including the plurality of timeperiods.

For example, in an embodiment, a computer program product for monitoringcomputer system operation may comprise a non-transitory computerreadable storage having program instructions embodied therewith, theprogram instructions executable by a computer, to cause the computer toperform monitoring and measuring metrics of system resource consumptionof a plurality of entities in at least one computer system to generateresource consumption data, generating a report of the system resourceconsumption data for the plurality of entities for each of a pluralityof time periods, identifying a number, k, of the plurality of entitiesas top-k consumers of computer system resources for each of theplurality of time periods, and identifying at least one residual entityof the plurality of entities whose resource consumption is not includedin the top-k entities based on residual resource consumption data of theentity for the plurality of time periods. For example, in an embodiment,the method may further comprise resampling the reports of the systemresource consumption data corresponding to the top-k entities and to theat least one residual entity to form at least one report covering a timeperiod including the plurality of time periods.

BRIEF DESCRIPTION OF THE DRAWINGS

The details of the present invention, both as to its structure andoperation, can best be understood by referring to the accompanyingdrawings, in which like reference numbers and designations refer to likeelements.

FIG. 1 is an exemplary block diagram of a computing environment in whichdescribed embodiments may be implemented.

FIG. 2 is an exemplary diagram of sampling and resampling techniquesthat consider metrics relating to entities other than those in thetop-k, according to embodiments described herein.

FIG. 3 is an exemplary flow diagram of a process of collection of thetop-k and residual items, according to embodiments described herein.

FIG. 4 is an exemplary flow diagram of a process of residual top-kresampling, according to embodiments described herein.

FIG. 5 is an exemplary block diagram of a computer system in whichprocesses involved in the embodiments described herein may beimplemented.

DETAILED DESCRIPTION

An exemplary computing environment 100 is shown in FIG. 1. In thisexample, computing environment 100 may include one or more system(s)being monitored 102, and one or more metrics of system 102 that arebeing collected, such as CPU load 104, memory use 106, network bandwidthuse 108, and other metrics 110. Such metrics may come in differenttypes, such as absolute quantities, relative counters, absolutecounters, etc. Collecting all these metrics from a large clustercomputing system may require a significant amount of storage space.Storage space requirements may be reduced by resampling older metricdata into a more coarse grained granularity. For metric types such asCPU load 104, memory use 106, network bandwidth use 108, etc.,resampling may be relatively straightforward.

There may be other metric types 110 for which resampling may be moreinvolved. For example, metric types that may capture the state of acomputing cluster may include, for example, processes or entities thatconsume CPU time. Typically, metrics relating to the most significantentities may be reported. That is, metrics relating to the top-kentities may be reported. Like other metrics, top-k metrics may beresampled. However, as different entities may be included in, orexcluded from, the top-k entities at different times, simply consideringand resampling only the top-k metrics may produce inaccurate results.Accordingly, embodiments of the present methods and systems may considermetrics relating to entities other than those in the top-k, in order toproduce more accurate resampled metrics.

An example of a resampling technique 200 that considers metrics relatingto entities other than those in the top-k is shown in FIG. 2. In theexample shown in FIG. 2, there is a plurality of entities 202 executingor otherwise existing in a computer system. Among entities 202, thereare, over time, a number of entities 204 that are in the top-k entitiesin terms of one or more metrics [s] 206. In this example, the particularentities that are included in the top-k entities may change over time.In addition, in this example, there may be an entity 208 that is notincluded in the top-k entities. Such entities may be included inresidual resource consumption.

This data is collected by a monitoring system and used to generate thefour reports which are shown in the middle of FIG. 2 (spanning the fourtime intervals 0-10, 10-20, 20-30, and 30-40). This data has not beenresampled yet.

When reports 210 are generated, without resampling, reports 212, 214,216, and 218 may be generated. In this example, report 212 includesinformation relating to entities e1, e2, and e3, and spans the timeinterval 0s-10s. Report 214 includes information relating to entitiese4, e5, and e6, and spans the time interval 10s-20s. Report 216 includesinformation relating to entities e7, e8, and e9, and spans the timeinterval 20s-30s. Report 218 includes information relating to entitiesea, eb, and ec, and spans the time interval 30s-40s. It is noted thatthe residual resource consumption for entity ex is included in thesecond report (the residual data is reported for the time periodspanning 0-20s). Entity ex was not included in either the first report212 or the second report 214 as a top-k item, but its residual resourceconsumption over both periods exceeds the resource consumption of thelowest other item in the second report and hence is reported in 214.Similarly, at the fourth report 218, the residual resource consumptionof entity ex for the time period 20-40s is reported (0-20s was alreadyreported in the second period).

An example of reports 221 and 222 generated after resampling 220 reportsis shown in FIG. 2. In this example, two reports are resampled at atime. The sizes of the boxes indicate the amount of resource consumed inthat timeframe. Accordingly, in reports 221, 222, entity ex is the topitem. For example, in report 221, covering 0-20s, since entity ex hadgreater resource consumption in this period than any other entity, ex isthe top entity, followed by entities e1 and e2, and entities e3, e4, e5,e6 are not included. The situation is similar for the second report,covering 20s-40s. In this report, ex is the top entity, followed byentities e7 and e8, and entities e9, ea, eb, ec are not included.

Examples of entities that may be included in resampled reports 221, 222may include entities for which residual resource consumption is greaterthan the resource consumption of at least one top-k process, for atleast some period of time, and for any top-k processes if residualresource consumption has been accumulated. As another example, resampledreports 221, 222 may include entities for which their residual resourceconsumption is greater than any top-k reported value. This may providethe capability to include the residual resource consumption in top-kreports, consider the residual resource consumption when resamplingdata, and again compute residual resource consumption data duringresampling.

In an embodiment, during resampling, information for entities e3-e6 ande9-ec may be discarded. In another embodiment, the residual resourceconsumption may be computed again for any entities not considered in anyresampled report and they may be included as residual resourceconsumption entities in a resampled report instead.

An exemplary flow diagram of a process 300 of residual top-k generationis shown in FIG. 3. This process may be used to determine which entitiesshould be included in a top-k report, including residual entities(entities with residual resource consumption). Process 300 begins with302, in which current resource consumption data and current time for allentities in existence in the last time period, last[i], are stored. Forexample, such data may be stored in a data structure such as:

  struct resdata{  time_t tm;  long res; }; resdata cur[N], last[N];

At 304, in an embodiment, process 300 may wait for a time period, suchas n seconds, the sampling period. At 306, a standard top-k report maybe generated. At 308, a loop over all entities i may be entered. At 308,it may be determined whether there are more elements to process. Ifthere are no more elements to process, then process 300 may continue at304, at which process 300 may wait for a time period, such as n seconds.If there are more elements to process, then process 300 may continuewith 310, in which it may be determined whether the current time periodresources used by entity i (“cur[i].res”), minus the last time periodresources used by entity i (“last[i].res”), is greater than theresources used by any top-k entity (“topk.res”). If not, then process300 may continue at 308. If so, then process 300 may continue at 312, inwhich the residual resources may be added for entity i. For example, thetime delta, “cur[i].tm-last[i].tm” may be computed. Likewise, theresource usage, “cur[i].res-last[i].res” may be computed. These computedquantities may be stored for entity i. At 314, the current resourceusage for the entity i may be stored as the last time period resourceusage for the entity i, and process 300 may continue at 308.

An exemplary flow diagram of a process 400 of residual top-k resamplingis shown in FIG. 4. This process may be used to resample entitiesidentified by process 300, shown in FIG. 3, including residual entities.In the example shown in FIG. 4, “rd” may represent the residual data ofthe set of reports to be resampled, and “period” may represent the timeperiod over which the resampling of the reports may be performed.

Process 400 begins with 402, in which the top-k entities identified byprocess 300 may be aggregated. Typically, such top-k entities may beaggregated into a map m that may be indexed by entity. At 404, a loopmay be entered over all residual entities “i”, and using the residualdata for each entity, “rd[i]”. If, at 404, there are no more elements tobe processed, then process 400 returns to 402 to perform the resamplingprocess for other reports via 404 a, 404 b, and optionally, 404 c. At404 a, the top-k entities may be taken from map m to be the resampledtop-k entities. At 404 b, the resampled top-k entities may be removedfrom map m. At 404 c, optionally, the remaining elements in map m may beaccumulated with previous such data in a residual resource consumptionmap m_(res). This map may again be used to add residual resourceconsumption data to the resampled reports. Performing 404 c allows thedata of otherwise discarded elements to be kept as residual resourceconsumption data. As a result, this enables repeated resampling of a setof resampled reports. If that is not necessary, then any elements thatare taken into account by 404 c may be discarded.

If, at 404, there are more elements to be processed, then process 400continues with 406, in which residual resource resampling is performed.The value “ri” may be computed as “rd[i].res*period/rd[i].tm”. Anupdated value of “m[i]” may be computed as “m[i]+ri”. An updated valueof “rd[i].res” may be computed as “rd[i].res-ri”. An updated value of“rd[i].tm” may be computed as “rd[i].tm-period”.

At 408, it may be determined whether the remaining residual time,“rd[i].tm” is less than or equal to zero. If so, then at 410, theresidual data for the entity being resampled, “rd[i]” may be removedfrom the residual data. If not, then the residual data for the entitybeing resampled, “rd[i]” is kept and process 400 loops back to 404 toprocess additional entities.

An exemplary block diagram of a computer system 500, in which processesinvolved in the embodiments described herein may be implemented, isshown in FIG. 5. Computer system 500 is typically a programmedgeneral-purpose computer system, such as an embedded processor, systemon a chip, personal computer, workstation, server system, andminicomputer or mainframe computer. Likewise, computer system 500 may beimplemented in a communication device, such as a network switch, router,traffic distributor, etc. Computer system 500 may include one or moreprocessors (CPUs) 502A-502N, input/output circuitry 504, network adapter506, and memory 508. CPUs 502A-502N execute program instructions inorder to carry out the functions of the present communications systemsand methods. Typically, CPUs 502A-502N are one or more microprocessors,such as an INTEL CORE® processor. FIG. 5 illustrates an embodiment inwhich computer system 500 is implemented as a single multi-processorcomputer system, in which multiple processors 502A-502N share systemresources, such as memory 508, input/output circuitry 504, and networkadapter 506. However, the present communications systems and methodsalso include embodiments in which computer system 500 is implemented asa plurality of networked computer systems, which may be single-processorcomputer systems, multi-processor computer systems, or a mix thereof.

Input/output circuitry 504 provides the capability to input data to, oroutput data from, computer system 500. For example, input/outputcircuitry may include input devices, such as keyboards, mice, touchpads,trackballs, scanners, analog to digital converters, etc., outputdevices, such as video adapters, monitors, printers, etc., andinput/output devices, such as, modems, etc. Network adapter 506interfaces device 500 with a network 510. Network 510 may be any publicor proprietary LAN or WAN, including, but not limited to the Internet.

Memory 508 stores program instructions that are executed by, and datathat are used and processed by, CPU 502 to perform the functions ofcomputer system 500. Memory 508 may include, for example, electronicmemory devices, such as random-access memory (RAM), read-only memory(ROM), programmable read-only memory (PROM), electrically erasableprogrammable read-only memory (EEPROM), flash memory, etc., andelectro-mechanical memory, such as magnetic disk drives, tape drives,optical disk drives, etc., which may use an integrated drive electronics(IDE) interface, or a variation or enhancement thereof, such as enhancedIDE (EIDE) or ultra-direct memory access (UDMA), or a small computersystem interface (SCSI) based interface, or a variation or enhancementthereof, such as fast-SCSI, wide-SCSI, fast and wide-SCSI, etc., orSerial Advanced Technology Attachment (SATA), or a variation orenhancement thereof, or a fiber channel-arbitrated loop (FC-AL)interface.

The contents of memory 508 may vary depending upon the function thatcomputer system 500 is programmed to perform. In the example shown inFIG. 5, exemplary memory contents are shown representing routines anddata for embodiments of the processes described above. However, one ofskill in the art would recognize that these routines, along with thememory contents related to those routines, may not be included on onesystem or device, but rather may be distributed among a plurality ofsystems or devices, based on well-known engineering considerations. Thepresent communications systems and methods may include any and all sucharrangements.

In the example shown in FIG. 5, memory 508 may include report generationroutines 512, residual top-k generation routines 514, residual top-kresampling routines 516, and operating system 518. For example, reportgeneration routines 512 may include routines that provide the capabilityto monitor and measure metrics and generate reports based on thosemetrics. Residual top-k generation routines 514 may include routinesthat provide the capability to determine which entities should beincluded in a top-k report, including residual entities (entities withresidual resource consumption). Residual top-k resampling routines 516may include routines that provide the capability to resample entitiesidentified to be included in the top-k entities, including residualentities. Operating system 518 may provide overall system functionality.

As shown in FIG. 5, the present communications systems and methods mayinclude implementation on a system or systems that providemulti-processor, multi-tasking, multi-process, and/or multi-threadcomputing, as well as implementation on systems that provide only singleprocessor, single thread computing. Multi-processor computing involvesperforming computing using more than one processor. Multi-taskingcomputing involves performing computing using more than one operatingsystem task. A task is an operating system concept that refers to thecombination of a program being executed and bookkeeping information usedby the operating system. Whenever a program is executed, the operatingsystem creates a new task for it. The task is like an envelope for theprogram in that it identifies the program with a task number andattaches other bookkeeping information to it. Many operating systems,including Linux, UNIX®, OS/2®, and Windows®, are capable of running manytasks at the same time and are called multitasking operating systems.Multi-tasking is the ability of an operating system to execute more thanone executable at the same time. Each executable is running in its ownaddress space, meaning that the executables have no way to share any oftheir memory. This has advantages, because it is impossible for anyprogram to damage the execution of any of the other programs running onthe system. However, the programs have no way to exchange anyinformation except through the operating system (or by reading filesstored on the file system). Multi-process computing is similar tomulti-tasking computing, as the terms task and process are often usedinterchangeably, although some operating systems make a distinctionbetween the two.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice.

The computer readable storage medium may be, for example, but is notlimited to, an electronic storage device, a magnetic storage device, anoptical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers, and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

Although specific embodiments of the present invention have beendescribed, it will be understood by those of skill in the art that thereare other embodiments that are equivalent to the described embodiments.Accordingly, it is to be understood that the invention is not to belimited by the specific illustrated embodiments, but only by the scopeof the appended claims.

What is claimed is:
 1. A computer-implemented method for monitoring system operation comprising: monitoring and measuring, using a hardware processor of at least one computer system, metrics of system resource consumption of a plurality of entities in the at least one computer system to generate resource consumption data; generating, using the hardware processor, a report of the system resource consumption data for the plurality of entities for each of a plurality of time periods; identifying, using the hardware processor, a number, k, of the plurality of entities as top-k consumers of computer system resources for each of the plurality of time periods; capturing, using the hardware processor, long term resource consumption data of an entity of the plurality of entities other than the top-k entities, said long term resource consumption data of the entity being stored as residual resource consumption data; determining, using the hardware processor, based on said residual resource consumption data for each entity of the plurality of entities other than the top-k entities, whether the resources used by the entity accumulated over the plurality of time periods is greater than the resources used by any top-k entity during any of the plurality of time periods; identifying, using the hardware processor, at least one residual entity of the plurality of entities as an entity whose accumulated resource consumption over said plurality of time periods is greater than the resources used by any of the top-k entities based on residual resource consumption data of the entity for the plurality of time periods; and resampling, using the hardware processor, the reports of the system resource consumption data corresponding to the top-k entities and to the identified at least one residual entity to generate at least one report covering a time period including the plurality of time periods, said generated at least one report reflecting a state of said at least one computing system with increased accuracy.
 2. The method of claim 1, wherein long term resource consumption data is used during resampling to provide consideration of long term resource consumption not included in resource consumption of the top-k entities.
 3. The method of claim 1, wherein residual resource consumption data captures long term resource consumption data of an entity that was included in the top-k entities, but is no longer included in the top-k entities due to the resampling. 